Is www.xn--dokumaanahtarlk-llc.net safe?

No. MalwareAnalyzer scanned www.xn--dokumaanahtarlk-llc.net on 22 Aug 2026 and returned a suspicious verdict with a score of 40 out of 100, categorised as phishing and credential-harvest. Treat it as hostile until it is re-checked.

What malware is associated with www.xn--dokumaanahtarlk-llc.net?

1 analysed samples communicate with this URL, including Phishing.

How was www.xn--dokumaanahtarlk-llc.net checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

www.xn--dokumaanahtarlk-llc.net - suspicious URL scan, 22 Aug 2026

MalwareAnalyzer by Cyble scanned www.xn--dokumaanahtarlk-llc.net and returned a suspicious verdict (score 40), categorised as phishing, credential-harvest. The page resolved to 5.2.85.161 on Alastyr Telekomunikasyon A.S. in TR. The domain was registered 4648 days ago through Isimtescil Bilisim A.S.. 9 domains and 1 IP were contacted, over 12 HTTP requests. 1 malware sample communicates with this URL (Phishing). The request followed 1 redirect before landing. This is a point-in-time observation from 22 Aug 2026; the page may have changed since.

Scan result

Verdict: suspicious (score 40) · Confidence 46%
Scanned URL: https://xn--dokumaanahtarlk-llc.net/userfiles/file/refijudilasuvumiduratu.pdf
Domain: www.xn--dokumaanahtarlk-llc.net · IP: 5.2.85.161 · AS3188 · TR
Server: LiteSpeed
Page title: Aradığınız Sayfa Bulunamadı!
HTTP status: 404 · text/html; charset=utf-8
Registrar: Isimtescil Bilisim A.S. · domain age 4648 days · created 2013-11-29
TLS issuer: C=US, O=Let's Encrypt, CN=YR1 · valid to Oct 1 01: · subject CN=mail.xn--dokumaanahtarlk-llc.net
HTTP requests captured: 12
Scan tier: fast · observed 2026-08-22 17:30:36 UTC

Redirect chain

https://xn--dokumaanahtarlk-llc.net/userfiles/file/refijudilasuvumiduratu.pdf
https://www.xn--dokumaanahtarlk-llc.net/userfiles/file/refijudilasuvumiduratu.pdf

Malware communicating with this URL (1)

These samples were observed contacting or being served from www.xn--dokumaanahtarlk-llc.net. Each links to its full analysis.

Phishing - referenced · 53b073348533190d0361e602dbc66c3a · first seen 2026-08-22

Antivirus & YARA (0 of 48 engines)

No engine flagged this page's content.

Why this verdict

Homograph / mixed-script domain (IDN spoofing)
Credential-harvesting form

Detected technologies

LiteSpeed
Bootstrap

Contacted infrastructure

5.2.85.161 - AS3188 Alastyr Telekomunikasyon A.S. (Turkey)

Observed indicators

www.xn--dokumaanahtarlk-llc.net
fonts.googleapis.com
www.googletagmanager.com
www.facebook.com
www.instagram.com
api.whatsapp.com
www.xn--nakanahtarlk-34bi59d.com
goo.gl
embed.tawk.to
5.2.85.161
https://www.xn--dokumaanahtarlk-llc.net/userfiles/file/refijudilasuvumiduratu.pdf
https://www.xn--dokumaanahtarlk-llc.net/
https://fonts.googleapis.com/css?family=Rubik:700,400,500,%7CChivo:400%7CMontserrat:700,400&subset=latin-ext
https://www.xn--dokumaanahtarlk-llc.net/userfiles/file/catalog/view/javascript/bootstrap/css/bootstrap.min.css
https://www.xn--dokumaanahtarlk-llc.net/userfiles/file/catalog/view/javascript/font-awesome/css/font-awesome.min.css
https://www.xn--dokumaanahtarlk-llc.net/userfiles/file/catalog/view/theme/journal3/icons/style.minimal.css
https://www.xn--dokumaanahtarlk-llc.net/userfiles/file/catalog/view/theme/journal3/stylesheet/style.css
http://www.xn--dokumaanahtarlk-llc.net/index.php?route=error/not_found
https://www.xn--dokumaanahtarlk-llc.net/userfiles/file/catalog/view/theme/journal3/lib/modernizr/modernizr-custom.js
https://www.xn--dokumaanahtarlk-llc.net/userfiles/file/catalog/view/theme/journal3/lib/jquery/jquery-2.1.1.min.js

Questions about www.xn--dokumaanahtarlk-llc.net

Is www.xn--dokumaanahtarlk-llc.net safe?: No. MalwareAnalyzer scanned www.xn--dokumaanahtarlk-llc.net on 22 Aug 2026 and returned a suspicious verdict with a score of 40 out of 100, categorised as phishing and credential-harvest. Treat it as hostile until it is re-checked.
What malware is associated with www.xn--dokumaanahtarlk-llc.net?: 1 analysed samples communicate with this URL, including Phishing.
How was www.xn--dokumaanahtarlk-llc.net checked?: A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the fast tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of www.xn--dokumaanahtarlk-llc.net

Scanned on MalwareAnalyzer by Cyble · Open interactive scan